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In the Claims: 

1. In a signaling network in which signaling messages are communicated between 
signaling points of the signaling network, an improvement of apparatus for selectably encoding 
at least portions of a signaling message communicated by way of a first selected signal point to 
5 at least a second selected signal point, said apparatus comprising: 

an encryption selector operable responsive to delivery of the signaling message at 
the first selected signal point, said encryption selector for selecting which, if any, portion of the 
signaling message to encrypt; and 

an encryptor adapted to receive indications of the signaling message and to 
10 receive indications of selection made by said encryption selector, said encryptor selectably for 
encrypting the portion of the signaling message selected by said encryption selector to be 
encrypted, the signaling message thereafter to be forwarded on to the second selected signaling 
point. 

15 2. The apparatus of claim 1 wherein the signaling network comprises an SS7 

signaling network, wherein the first selected signal point comprises a first signaling transfer 
point and wherein said encryption selector and said encryptor are embodied at the first signaling 
transfer point. 

20 3. The apparatus of claim 1 further comprising an encryption selection database 

accessible by said encryption selector, said encryption selection database maintaining an index of 
which portion, if any, of the signaling message is to be encrypted, and wherein said encryption 
selector accesses the index maintained at said encryption selection database pursuant to the 
selection of which, if any, portion of the signaling message to encrypt, 

25 

4. The apparatus of claim 3 wherein the signaling message is originated by an 
originating node and wherein the index maintained by said encryption selection database 
comprises indicia associated with' the originating node indexed together with values 
representative of which, if any, portion of the signaling message is to be encrypted. 
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5. The appai'atus of claim 3 wherein the second selected signal point to which the 
signaling message is to be forwarded is identified by an identifier and wherein the index 
maintained by said encryption selection database comprises indicia associated with the identifier 
indexed together with values representative of which, if any, portion of the signaling message are 
to be enciypted. 

6. The apparatus of claim 1 wherein the signaling message comprises a header part 
and a payload part and wherein the portion, if any, of the signaling message selected by said 
encryption selector to be encrypted comprises a selected portion of the payload part. 

7. The apparatus of claim 6 wherein the signaling network comprises an SS7 
signaling network, wherein the signaling message comprises a message signaling unit, and the 
payload part of the signaling message comprises a portion of the message signaling unit. 

8. The apparatus of claim 7 wherein the payload part of the message signaling unit 
forming the signaling message that said encryptor selectably encrypts comprises at least a 
selected one of an MTP3 part and an AP part, and wherein said encryption selector selects, if 
any, at least one of the MTP3 part and the AP part of the message signaling unit. 

9. The apparatus of claim 1 wherein said encryptor encrypts the portion of the 
signaling message pursuant to a public-key encryption scheme. 

10. The apparatus of claim 9 wherein the second selected switch node to which the 
signaling message is to be forwarded is identified by an identifier and wherein the public-key 
encryption scheme used by said encryptor encrypts the portion, if any, of the signaling message 
using a public encryption key associated with the identifier that identifies the second selected 
signal point. 

11. The apparatus of claim 10 wherein said apparatus further comprises an enciyption 
key database accessible by said encryptor, said encryption key database maintaining an index 
that indexes together the public encryption key and the identifier associated therewith. 
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12. The apparatus of claim 1 1 wherein said encryptor accesses said encryption key 
database pui'suant to encryption of the portion of the signaling message selected by said 
encryption selector to access the encryption key associated with the second selected signal point. 

13. In the signaling network of claim 1 further including apparatus for selectably 
decoding the signaling message, said apparatus comprising: 

a detector adapted to receive indications of the signaling message, said detector 
for detecting which, if any, part of the signaling message is encrypted; and 

a de-encryptor adapted to receive indications of detections made by said detector 
and to receive indications of the signaling message sent to the second selected signal point, said 
de-enciyptor selectably for de-encrypting the encrypted portion, if any, of the signaling message. 

14. The apparatus of claim 13 wherein the signaling message is delivered to said 
detector and to said de-encryptor by way of an untrusted communication path. 

15. The apparatus of claim 13 wherein de-encryption performed by said de-enciyptor 
utilizes an encryption key to de-encrypt the encrypted portion, if any, of the signaling message. 
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16. In a method of communicating in a signaling network in which signaling 
messages are communicated between signaling points of the signal network, an improvement of 
a method for selectably encoding at least portions of a signaling message communicated by way 
of a first selected signal point to at least a second selected signal point, said method for 
selectably encoding comprising: 

selecting, responsive to delivery of the signaling message at the first selected 
signal point, which portion, if any, of the signaling message to enciypt; and 

selectably encrypting, responsive to selection made during said operation of 
selecting, the portion, if any, of the signaling message; and thereafter 

forwarding on the signaling message to the second signal point. 

17. The method of claim 16 wherein the signaling network comprises an SS7 
signaling network, wherein the first selected signal point comprises a first signaling transfer 
point, and wherein said operations of selecting and selectably encrypting ai'e performed at the 
first signal transfer point 

18. The method of claim 16 further comprising the operations of delivering the 
signaling message to the second signal point, determining whether any portion of the signaling 
message is encrypted, and decrypting the portion of the signaling message that is determined 
during said operation of determining to be encrypted. 

19. The method of claim 18 wherein said operation of forwarding is perfomied by 
way of a communication path of an untrusted level of security. 

20. The method of claim 1 8 wherein said operations of encrypting and decrypting are 
performed pursuant to a public-private key encryption and decryption scheme. 
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